snakekeylogger | 57e7f91be19a8356a1021663353af9d2cc072b7c0137a41641c3c03321e9ef50

General

Target

812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe
Size

820KB
MD5

9967ee5fb6a3fa6a232e99953e9c10ae
SHA1

eadefb78c0d088f86e211957a1d144f619f6f163
SHA256

812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef
SHA512

f4fb4debdcfe397af5a5a17da50821c5258f50edbaf792e72a476bf0cd2bc833ba3f28426e84f839c6f052d61190b7318bd21ca9a5e11e28a2dfc79e30111e05
SSDEEP

12288:ZxeU8cjHn+GcTJOGOMDDDL3oRfMhYKCUo8riafbdIGuXOGS01DM:qauVZSAaUo8riaTd4+GSe

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
viajescoriatours.com
Port:
587
Username:
[email protected]
Password:
170717FteoS%
Email To:
[email protected]

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2840-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2840-14-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2840-17-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2840-19-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2840-22-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe

description	pid	process	target process
PID 1084 set thread context of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1212 2840 WerFault.exe InstallUtil.exe

pid	pid_target	process	target process
1212	2840	WerFault.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exeInstallUtil.exe

pid	process
1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe
1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe
2840	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe
Token: SeDebugPrivilege	2840	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exeInstallUtil.exe

description	pid	process	target process
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 1084 wrote to memory of 2840	1084	812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe	InstallUtil.exe
PID 2840 wrote to memory of 1212	2840	InstallUtil.exe	WerFault.exe
PID 2840 wrote to memory of 1212	2840	InstallUtil.exe	WerFault.exe
PID 2840 wrote to memory of 1212	2840	InstallUtil.exe	WerFault.exe
PID 2840 wrote to memory of 1212	2840	InstallUtil.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe
"C:\Users\Admin\AppData\Local\Temp\812108284bc6345fe8831d13d26d68073af1b82d39b3a67ff9310528ca7c59ef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 544
    3⤵
    - Program crash
    PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-20-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/1084-1-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/1084-2-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/1084-3-0x0000000002070000-0x00000000020B4000-memory.dmp

Filesize
272KB

Download
memory/1084-4-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/1084-5-0x0000000000BF0000-0x0000000000C30000-memory.dmp

Filesize
256KB

Download
memory/1084-6-0x0000000000A20000-0x0000000000A3A000-memory.dmp

Filesize
104KB

Download
memory/1084-7-0x0000000000A40000-0x0000000000A46000-memory.dmp

Filesize
24KB

Download
memory/1084-0-0x00000000002A0000-0x0000000000374000-memory.dmp

Filesize
848KB

Download
memory/2840-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2840-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2840-23-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2840-24-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads